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We investigate the security of continuous- variable quantum key distribution using coherent states 
and reverse reconciliation against Gaussian individual attacks based on an optimal Gaussian 1 — >• 2 
cloning machine. We provide an implementation of the optimal Gaussian individual attack. We 
also find a Bell-measurement attack which works without delayed choice of measurements and has 
better performance than the cloning attack. 
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I. INTRODUCTION 

Quantum mechanical properties of physical systems 
make it possible to implement physically secure communi- 
cation between distant parties, whereas it is impossible to 
achieve such a task only by the transmission of classical 
signals. An interesting and actively investigated problem 
of the so-called quantum key distribution (QKD) protocols 
is how to achieve the secret-key sharing using imperfect 
semi-classical signals and devices pj . One of the standard 
approaches is to implement photonic qubits by weak co- 
herent states. QKD protocols have also been proposed 
based on quantum continuous-variable (CV) systems via 
coherent states S S IE E| O ne of the central ideas in 
CV QKD is that the legitimate receiver (Bob) of the sig- 
nal measures one of the conjugate quadratures randomly, 
although an exception is found |{| . There are two different 
types of CV-QKD protocols called postselection 0Jjl and 
reverse reconciliation (RR). In the RR protocol [5|, the 
sender (Alice) of the signal infers the measurement results 
of Bob to share the key. 

In the classical picture, an amplifier (AMP) followed by 
a beam splitter (BS) provides perfect copies of the signal. 
Thus an eavesdropper (Eve) can obtain a perfect copy 
without making any disturbance on the signal. Then, by 
repeating this process, Eve can obtain arbitrary number of 
identical copies and characterize the signal with a desired 
resolution. In quantum theory, the amplification comes 
with spontaneous noise • Thus the copies are imperfect 
and Eve's intervention can be detected due to the distur- 
bance. In addition to this, her knowledge about the signal 
is limited by the imperfection in the copies. 

In CV systems, the AMP-followed-by-BS scheme pro- 
vides an optimal Gaussian 1 — > 2 cloning machine which 
makes the best approximate copies of Gaussian states Q ■ 
The impossibility of the cloning is sometimes connected 
with the security of QKD. Because a doner makes a con- 
crete example of eavesdropping attacks which always in- 
duces disturbance on the original system, one may think 
that the security against the best cloning attack is a good 
measure of QKD performance. However, the conditions 
of the optimal cloning and optimal eavesdropping attack 
are in general different. The optimal doner provides two 
imperfect copies and one imperfect phase-conjugate-like 
state of the input called the anticlone. In the cloning at- 
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tack, Eve keeps one of the imperfect copies from which she 
intends to distill information, and discards the anticlone. 
It is natural to consider that Eve can perform a better 
attack by combining the clone-anticlone pair. 

In connection with the clone-anticlone pair, there may 
exist several interesting quantum operations. For exam- 
ple, it is possible for Eve to erase the signal information 
and cancel the amplification noise by properly perform- 
ing a Bell measurement on the clone-anticlone pair and 
displacing the other clone according to the measurement 
outcome as in CV quantum teleportation, although in this 
case Eve obtains no signal information [tj . It is also known 
that quadrature signals can be efficiently encoded by using 
the phase conjugate pair of coherent states \a) (g> |cv*) com- 
pared with the normal pair \a) <g> \a) 0. This suggests 
that Eve can also read the quadrature signal efficiently 
from the clone-anticlone pair. A variant of cloning ma- 
chines that works with the phase-conjugate input has also 
been proposed |Tlj . 

In this paper, we consider the security of CV QKD us- 
ing coherent states and RR .5] against the cloning attack 
and its natural extensions, where, in addition to the clone, 
Eve also keeps and utilizes the anticlone. We show that 
an optimization of this attack corresponds to the opti- 
mal Gaussian individual attack |3, Il2j . The realization of 
the optimal attack as well as that of the cloning attack 
seems to be impossible within the present technology be- 
cause the attacks need a quantum memory to store the 
quantum signal for a sufficiently long time. We find a 
Bell-measurement attack which works without a quantum 
memory and has better performance than the cloning at- 
tack. 



II. EVE'S STRATEGY 

Let us consider a three-mode bosonic system and the 
quantum circuit including an AMP and two BSs as in 
Fig. n Alice prepares her state on the mode a which 
is the input mode of the doner. Eve uses the ancillary 
modes b for the second clone and c for the AMP. 

Eve's operation is as follows: First, Eve amplifies the 
input of the mode a with the ancillary mode c. Next, Eve 
combines the amplified mode a' and the other ancillary 
mode b by a BS with the transmission cos 2 4>. One of the 
outgoing clones (clone I) on the mode a" is received by 
Bob, and the other clone (clone 2) on the mode b 1 is kept 
by Eve. After Eve learns Bob's measurement basis, she 
combines the anticlone on the mode c' , which comes from 
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cloning machine 

FIG. 1: Eve's attack is based on the Gaussian cloning machine 
which is constructed by a linear amplifier (AMP) followed by 
a beam splitter (BS). 



the ancillary mode of the AMP, and the clone 2 by a BS 
with the transmission cos 2 9. Finally, Eve performs her 
measurement on b" and c". 

We define position quadrature and momentum quadra- 
ture of mode k — {a, b, c, • • • } by 



„ k + fc f „ _ k - fc f 
2 li 



(1) 



where k (fct) is the annihilation (creation) operator of 
mode k. 

The transformations between modes are described by 
the unitary operators 



(2) 



for an AMP with the amplification gain g = cosh 2 A > 1 
and 



V aib {6) = e e(ab a b) 



(3) 



for a BS with the transmission cos 2 9. 

The transformations between the modes are explicitly 
written as 



b' 



Ul c (X)aU a , c (X) 

a cosh A — sinh A 
c cosh A — a* sinh A 
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1 
1 



sinh A 



1 
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- sin f a 



cos<5 

sin cos 



b"\ _ { V b \ c ,(9)b<V b ,y(9) 



cos9 -sin# \ ( b' 
sin 9 cos 9 ) \ c' 



(4) 



(5) 



(6) 



Combining Eqs. (QJ,I© and ©, we obtain the mode op- 
erators of the output: 



a" \ I cosh A cos — sin</> 
b" j = ( cosh A cos 9 sin 4> cos 9 cos < 
cosh A sin 9 sin d> sin 9 cos ( 



\ / a \ /OOcos0 

— cosh A sin 9 b I — sinh A — sin 9 cos 9 sin < 
cosh A cos I \ c I \ cos 9 sin 6* sin f 



6 f • (7) 



Note that the state of Bob's mode a" is determined by A 
and (j), and does not depend on 9. 

In what follows, we use an abbreviated notation 



(F) a ee c (0| 6 (0| a (a|F|a) a |0) fc |0) c 



(8) 



where we defined the coherent state \ot)k with the ampli- 
tude a of mode k — {a, b, c} by k\a)k — ot\a)k- For ex- 
ample, we can write the amplitudes of the output modes 
associated with the input |cv) a as 



(a") a = a cosh A cos <p, 
{b") a — ol cosh A cos 9 sin < 
(c') a — a cosh A sin 9 sin c 



(9) 

- a* sinh A sin 9, (10) 
a* sinh A cos 9. (11) 



From these expressions, we can see that Eve's operation 
does not couple the real and imaginary parts of quadra- 
tures. This fact suggests that it is inefficient for Eve to 
measure a quadrature with an angle different from the 
one chosen by Bob. So we consider strategies in which 
Eve measures the same quadrature as Bob chooses. 

We assume that Alice and Bob have the lossy and noisy 
transmission channel characterized by the line transmis- 



sion t] and excess noise 5, those are related to the ampli- 
tude and variance of Bob's mode a" by 



(12) 



((Aav0 2 )a = (x 2 a , l ) a -(x a , / ) 2 a = -(l + S). (13) 

Suppose that Eve replaces the channel with the circuit in 
Fig. n Then, A and are determined to be 



tan < 




tanh A 



(14) 
(15) 



If we take 9 = 0, rj = 1, and 5 = 1, the circuit is the 
optimal Gaussian 1 — + 2 cloning machine 8J. In this case 
we can see that the states of a" and b" are symmetric 
clones (a") a = (b ) a = a and the clone-anticlone pair has 
the time-reversal relation (c") a = —a* = — (a"}*. 

If we take 9 = 7r/4, 77 = 1, and 6 = 1, we can see 
that the mode operators of b" and c" almost duplicate the 
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position and momentum quadrature of the input mode, 
respectively: 



1 ; 



1 



V2x a + - c - -, 

r If 1 
\2ip a + -b + c — - 



c' . 



(16) 
(17) 



2 — corresponds to Alice's position 
quadrature which is determined by Alice's choice of the 
parameter a. From Eqs. 123|) - (|25[1 . we have 



V(x B \x A ) = -(l + 8). 



(26) 



This relation implies that by measuring x b » and p c " si- 
multaneously Eve can efficiently learn the amplitude of 
the input state as in the efficient coding ^(j- This mea- 
surement is considered to be a Bell measurement on the 
modes b' and c'. As we will show later this Bell measure- 
ment leads to an efficient attack which does not need the 
quantum memory to store the signal coherently. 



III. REVERSE RECONCILIATION PROTOCOL 
AND CONDITIONAL VARIANCES 

In the RR protocol, Alice sends the coherent state \a) a 
with the probability density 



P(a) = 



-e v a< 



(18) 



and Bob randomly measures one of the quadratures. The 
density operator of the input state can be written as 

p = J P(a)|a) Q |0) b |0) cc (0| fc (0| a (a|d 2 a. (19) 

For calculation of the expectation values the following 
form is convenient 



(F) ee Tr (Pp) = J 



P(a)(F) a d 2 a. 



(20) 



A sufficient condition for secure key distribution against 
a Gaussian individual attack where Eve uses the measure- 
ment result of a single mode quadrature after Bob's basis 
is declared is given by 



V(x b \xa)-V(x b \xe) < 0, 
V(p B \ PA )-V( PB \p E ) < 0, 



(21) 



where the conditional variance of x given y is defined by 

\(xy) - (x)(y)\ 2 



V(x\y) = ((Ax) 2 ) 



((Ay) 2 ) 



(22) 



and the variables of Alice, Bob and Eve are denoted by 
the subscripts A, B and E, respectively. The conditional 
variance becomes smaller as the variables become more 
correlated. 

Let us calculate Alice's conditional variances, V(x b \xa) 
and V(pb\pa)- In our formulation, the first moment of the 
quadratures is (£k) = (pk) = for any k. The relevant 
terms for V(xb\xa) can be written as 

(4) = (x 2 a „)= [ P(a)(x 2 a „) a d 2 a= hl +T ,V A +S), 



(x a xb) = P(a)(x a x a ") a d 2 a = 



VvVa 



(23) 
(24) 



P(a)x 2 a d 2 a 



V A 



It means that Alice can predict Bob's measurement result 
within the uncertainty of the vacuum noise plus excess 
noise. This is also a direct consequence of Eq. (|f 3|) . Sim- 
ilarly we have 



V(pb\pa) = - a {1 + 8). 



(27) 



To calculate Eve's conditional variances, V(xb\xe) and 
V(Pb\Pe)-> us assume that Bob measures x a " and 
then Eve adjusts 6 and measures Xw(6). In this case, 
V(x B \x E ) = V(x a »\x b n(e)). From Eqs. Q, (HJ, and 
lfT5|l we can write 



X a " = \fr\Xa - V 1 V + S/2x b - y/S/2x c , (28) 
xv{9) = Xx a + Yx b + Zx c , (29) 



where 

X EE 
Y EE 
Z EE 



1 



V^/2 
1 

i 



( v ^V / l-?7 + (5/2cos6i + y/S/2i 



(17- 8/2) cos 9, 



( y/rj sin 9 + \f5/2\Jl - r] + 5/2 cos 9) . 

(30) 



Then, using 



(%) = \> (£ 2 a ) = \(v A + i), 



\X a Xb) 



\X~bXc 



\X C X Q 



0. 



(31) 



we obtain 



(xv (Of 



= X 2 (x 2 ) 



Y 2 (x 2 ) 



Z 2 (x 2 ) 



= -(X 2 (V A + l) + Y 2 + Z 2 ) 



(32) 



(X E X B ) = (x a "X b »(9)) 



= y/TjX(& a ) — Yyjl — T) + 8/2(3$) - Zy/S/2(x 2 c ) 
= i (ytjX(V A + 1) - Yy/1 -Ti + 8/2 - Zy/6/2) . 

(33) 



(25) From Eqs. and J33Jl, we can write 
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vM^m - v m (e)^-(i + s+ ^ \ Va + 1)x2 + y2 + z I — ] - 



(34) 



with 



(35) 



Since the replacement of the modes 6" — * c" corresponds 
to the replacement 8^9 — 7r/2in Eq. (J), we can write 

V(z a „|£ c »(0)) = V BlE (6-n/2). (36) 

The conditional variance of momentum quadratures can 
be calculated in the same manner and we can verify 

V{p a »\h»{6)) = V B \ E {-9\ (37) 
V(p a »\p c >,(9)) = V B]E (*/2-0). (38) 



Using relations (3%jl. (55j l. (|3*7|) . and (|3*9"|) . we can calculate 
V(xb\xe) and U(ps|p£;) for various strategies taken by 
Eve. From Eqs. (|3^jl and (|3"9"|l . we can see that by setting 
9 = 7r/4 Eve can estimate both of the quadratures with 
the same uncertainty simultaneously, i.e., 

K(4„«|f6«(7r/4)) = V(p a „\p c „(Tr/4)) 

= V b]e (-k/A). (39) 



I 

IV. CLONING AND GAUSSIAN INDIVIDUAL ATTACKS 

In this section, we investigate the security condition 1)21(1 for the following four attacks. Firstly, we consider two 
simple attacks where Eve uses either the clone 2 or the anticlone. We call them the cloning attack and the anticloning 
attack, respectively. Next, we consider two attacks where Eve uses both the clone 2 and the anticlone. In one attack, 
Eve does not use the quantum memory and performs a Bell measurement. In the other attack Eve optimizes 9 in order 
to minimize her conditional variance. 



A. Cloning attack 



We assume that Eve utilizes only the mode b' (clone 2). In this case, V(xb\xe) = V{x a >/\xb>) and V(pb\pe) — 
V(p a "\pb')- Using the relations Xb> — ib»(0), pb> =pb"(0), (32), and (39, we obtain 

vfeM - VMM = v.„(o) - P + H1 + (V ^W\ V $ 1 + W _ v)y W 

The security condition (|21|1 requires 

^>?7clonc = 4^(1 + S) { (3 + 6)VA ~ 26+ ^ + 5)VA + + 

5(3 + 6) f 6 r 45 IW A + 45 2 1 

~ 4(1 + 5)} (3 + 6)V A + V + (3 + 5)V A + (3 + <5) 2 Uj [ ' ( ' 



B. Anticloning attack 

We assume that Eve utilizes only the mode c' (anticlone). In this case, V(xb\xe) = V(x a »\x c <) and V(pb\pe) = 
V(Pa"\Pc>)- Using the relations x c > — Xb"(n/2), p c > = pb"(n/2), (54*j l. and (|3*7jl . we obtain 

V(x B \x E ) = V( Pb \pe) = V BlE (n/2) = 1 + 5- (42) 



We can write the security condition as 

- ( 4 

_" > Tl + 

2V A \V a 2 



V > ?7anticlone = 1~J = \ JT + - ) 6. (43) 
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C. Bell measurement attack without delayed choice 



As we have seen in the ends of Sec. II and III, Eve may perform a Bell measurement on the clone-anticlone pair without 
using any quantum memory. Suppose that Eve's operation is as follows: Eve fixes 9 — 7r/4 so that the contributions of 
the mode a to the modes b" and c" become equivalent. She performs position-quadrature measurement on the mode 
b" and momentum-quadrature measurement on the mode c" right after she received the state. She chooses one of the 
measurement results after she learns Bob's choice of the quadratures. We call this attack the Bell measurement attack 
(BMA). In this case, V(x B \x E ) = V(x a " \x b » (7r/4)) and V(p b \pe) = V(p a "\p c "(Tr/4)). Thanks to the relation we 
can estimate Eve's conditional variances by 



Vb| E (7t/4) 



V a (2t 1 -8) 2 



S 2 + 2(V A + 2)^/277*5(1 - 77 + 5/2) + 8{V A + 2+{V A - 2)77} + 2 V {2 + V A (1 - 77)} 

(44) 



The security condition becomes 

26 (y A + l- 6/2 + ^(V A + 2)(V A -8)^j 



V > Vbma 




(45) 



D. Optimal Gaussian individual attack 



E. Discussion 



In our formulation, Eve's optimal strategy is to select 9 
in order to minimize her conditional variance. The mini- 
mum value of Vb\e is given by 



Vb\e(6 'opt) 



l + V A 



with 



y opt 



tan 



(1 + V A )(1 + S)- V V A 



V¥(2 + V A ) 



(46) 



y/2 - 2r) + 6{V A (ri -S)-S}' 
(-tt/2 < 9 opt < tt/2). (47) 

Eve can achieve the optimal value for each quadrature 
by measuring Xb"(9 op t) or Pb"(— O pt) according to Bob's 
choice, position or momentum quadrature, respectively; 

V(x B \x E ) = V(x a »\x b »(6 opt )) = V B \ E (9 pt) 
V{ Pb \pe) = V{p a n\p b „{-e opt ))=V B \ E {9 opt ). (48) 

The value V b \e{9 opt) corresponds to the lower bound of 
Eve's conditional variance which saturates the Heisenberg- 
type uncertainty relation [5L ll2LlT3| and thus the optimiza- 
tion of our scheme gives an implementation of the optimal 
Gaussian individual attack. Another implementation of 
the optimal Gaussian individual attack is found in |l2j |. 

The security condition can be written as 



V > Vopt 



1 + V A 6(2 + 6) 



V A (1 + 6)' 
In the high-modulation limit (V A — > 00), we have 

1 



(49) 



VB\E(6opt) 



'opt 



1 



tan 



V 



V2 - 277 + J(r? - 8) ' 



(50) 



In Fig. 13 we show the curves given by 77 = ?7opt, 
V = Vbma, V = 77 ant i c iono, and 77 = 77 clonc at the high- 
modulation limit (V A — » 00). For each attack, the secu- 
rity condition is satisfied below the curve. We also show 
a necessary condition of CV QKD using coherent states 
[bH ITEj : 77 > 8/2. This bound is given by an intercept- 
rcscnd attack based on the simultaneous measurement of 
the quadratures and can be also derived from the sepa- 
rable condition of CV systems 0, ^| . Above this curve 
secure key distribution is impossible. 

From Fig. [21 we can see that the anticloning attack is 
better than the cloning attack and BMA is better than 
the anticloning attack at the high-modulation limit. This 
order is conserved in the case of finite modulation provided 
V A > S and 5 < 2/3, i.e., from Eqs. gTJ), @3J|, (gSJ and 
l|49|) we can verify 



Vopt > 7?BMA ^ 77 ant icIone ^ ^?clonc 



> 



> 



(51) 



It shows that the cloning attack is the weakest attack 
among the four. The fact that the cloning attack is weaker 
than the anticloning attack seems to be counter-intuitive 
because the amplitude of the clone 2 is always larger than 
that of the anticlone if S < 2r], i.e., 



> 1. 



(52) 



An interpretation of the result is as follows: One can show 
that the clone 1 and clone 2 are not entangled but in a 
mixture of coherent states ^f|- Thus the bipartite sys- 
tem cannot make stronger correlations between any two 
of the quadratures beyond the vacuum fluctuation. On 
the other hand, since the amplified mode and anticlone 
mode, a' and c', are entangled due to the process of the 
AMP, it is possible to make stronger correlations between 
the quadrature of them beyond the vacuum fluctuation. 
This leads to a smaller conditional variance. 
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a characteristic of CV QKD using coherent states. In 
general, indirect measurement is considered to be pow- 
erful because Eve can use a quantum memory and she 
can perform her measurement after she learns Bob's mea- 
surement basis. If Eve cannot use the quantum memory 
she has to measure different quantities simultaneously to 
infer the signal because she does not know the basis. Gen- 
erally the simultaneous measurement of non-commutable 
observables costs additional noise and indirect measure- 
ment without delayed choice seems to be inefficient. How- 
ever, in our case of the CV QKD under realistic condi- 
tion, the difference between with and without the quan- 
tum memory is not significant as shown above. From prac- 
tical aspect BMA should be considered seriously because 
it means that a very efficient attack can be realized with- 
out advanced technologies. 

V. SUMMARY 



FIG. 2: Fhe security condition is shown for the line transmis- 
sion r\ and quadrature excess noise 5 in the high-modulation 
limit (Va — > 00). The dash-dotted line is for the cloning at- 
tack, the dotted line is for the anticloning attack, the dashed 
line is for the Bell- measurement attack, and the solid line is for 
the optimal Gaussian individual attack. The dot-dash-dotted 
line is for the intercept-resend attack which gives a necessary 
condition of C V QKD using coherent states \b& fl5|) . 

Relation (|5 1|) also shows that the clone-anticlone pair 
without delayed choice of measurements provides a better 
attack than either of the cloning and anticloning attacks. 
This implies the utility of the phase-conjugate pair [i^lTcl 

EH- 

In the high-modulation and high-loss limit (Va 3> 1 
and, 77 < 1), from Eqs. igTJl, igSJl, (gSJ), and |@SJ| we can 

see that the cloning and anticloning attacks provide nearly 
the same security bound 

3 

Vclone ^ ??anticlonc v^*v 

and that BMA provides nearly optimal bound: 

?7bma ~ Vopt ~ 26. (54) 

The existence of such an effective attack without delayed 
choice of measurements is interesting and it seems to be 



We have investigated the security of CV QKD using 
coherent states and reverse reconciliation against individ- 
ual Gaussian attacks based on an optimal Gaussian 1— >2 
cloning machine. We have assumed that one of the clones 
is delivered to Bob and Eve combines the other clone and 
the anticlone using a BS and performs quadrature mea- 
surements. In this approach, we can connect and analyze 
different individual Gaussian attacks just by changing the 
parameter of the BS. 



We found an efficient individual attack which works 
without delayed choice of measurements and has bet- 
ter performance than either of the cloning and anti- 
cloning attacks. The operation of this attack provides 
a simultaneous-measurement scheme which leaves an im- 
perfect copy. In other words, it provides a way to perform 
a simultaneous measurement of the quadratures indirectly 
so that the measurement induced noise corresponds to a 
given value. In the high- loss and high- modulation limit, 
we showed that the security bound given by this attack is 
nearly the same as the one given by the optimal Gaussian 
individual attack. We also found that the optimization of 
the BS parameter with a delayed choice of measurements 
provides an implementation of the optimal Gaussian indi- 
vidual attack. 
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